From owner-freebsd-questions@FreeBSD.ORG Mon Nov 29 11:29:46 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id C86B816A4CE for ; Mon, 29 Nov 2004 11:29:46 +0000 (GMT) Received: from ei.bzerk.org (ei.xs4all.nl [213.84.67.5]) by mx1.FreeBSD.org (Postfix) with ESMTP id 9ADAE43D31 for ; Mon, 29 Nov 2004 11:29:45 +0000 (GMT) (envelope-from mail25@bzerk.org) Received: from ei.bzerk.org (BOFH@localhost [127.0.0.1]) by ei.bzerk.org (8.13.1/8.13.1) with ESMTP id iATBUPc6072811; Mon, 29 Nov 2004 12:30:25 +0100 (CET) (envelope-from mail25@bzerk.org) Received: (from bulk@localhost) by ei.bzerk.org (8.13.1/8.13.1/Submit) id iATBUKJs072810; Mon, 29 Nov 2004 12:30:20 +0100 (CET) (envelope-from mail25@bzerk.org) Date: Mon, 29 Nov 2004 12:30:20 +0100 From: Ruben de Groot To: Giorgos Keramidas Message-ID: <20041129113020.GA72673@ei.bzerk.org> Mail-Followup-To: Ruben de Groot , Giorgos Keramidas , Jonathon McKitrick , freebsd-questions@freebsd.org References: <20041127215612.GA86416@dogma.freebsd-uk.eu.org> <20041128013135.GD662@gothmog.gr> <20041128044847.GA1435@dogma.freebsd-uk.eu.org> <20041128122741.GB43088@gothmog.gr> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20041128122741.GB43088@gothmog.gr> User-Agent: Mutt/1.4.2.1i X-Spam-Status: No, score=-2.3 required=5.0 tests=ALL_TRUSTED, FROM_ENDS_IN_NUMS autolearn=failed version=3.0.0 X-Spam-Checker-Version: SpamAssassin 3.0.0 (2004-09-13) on ei.bzerk.org cc: Jonathon McKitrick cc: freebsd-questions@freebsd.org Subject: Re: Is this a hole in my firewall? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Nov 2004 11:29:46 -0000 On Sun, Nov 28, 2004 at 02:27:41PM +0200, Giorgos Keramidas typed: > On 2004-11-28 04:48, Jonathon McKitrick wrote: > > On Sun, Nov 28, 2004 at 03:31:35AM +0200, Giorgos Keramidas wrote: > > : AFAIK, rule 00300 will never be hit by packets going out tun0 as long as > > : you also have rule 00200 in there. > > > > Hmmm.... here's a run after having the laptop running for a bit. I don't > > see why 200 doesn't cover the case either. > > > > root@neptune:~# ipfw show > > 00100 0 0 check-state > > 00200 6709 1277079 allow ip from me to any keep-state out xmit tun0 > > 00300 2093 645797 allow ip from any to any keep-state out xmit tun0 > > Oops! That doesn't look good, unless I'm missing something about the > way 'me' works. He's using ppp-nat. So packets from his laptop will first hit rule #300 and only after that get "nat'ed". I believe this is normal behaviour. Ruben > It's probably a good idea to send what you have so far to the > freebsd-ipfw people. > > > _______________________________________________ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org"